cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 109

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE

Related attack patterns (CAPEC): 59
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-116 Excavation Likelihood: High · Severity: Medium
  • CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
  • CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
  • CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
  • CAPEC-287 TCP SYN Scan Severity: Low
  • CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
  • CAPEC-291 DNS Zone Transfers Severity: Low
  • CAPEC-292 Host Discovery Severity: Low
  • CAPEC-293 Traceroute Route Enumeration Severity: Low
  • CAPEC-294 ICMP Address Mask Request Severity: Low
  • CAPEC-295 Timestamp Request Severity: Low
  • CAPEC-296 ICMP Information Request Severity: Low
  • CAPEC-297 TCP ACK Ping Severity: Low
  • CAPEC-298 UDP Ping Severity: Low
  • CAPEC-299 TCP SYN Ping Severity: Low
  • CAPEC-300 Port Scanning Severity: Low
  • CAPEC-301 TCP Connect Scan Severity: Low
  • CAPEC-302 TCP FIN Scan Severity: Low
  • CAPEC-303 TCP Xmas Scan Severity: Low
  • CAPEC-304 TCP Null Scan Severity: Low
  • CAPEC-305 TCP ACK Scan Severity: Low
  • CAPEC-306 TCP Window Scan Severity: Low
  • CAPEC-307 TCP RPC Scan Severity: Low
  • CAPEC-308 UDP Scan Severity: Low
  • CAPEC-309 Network Topology Mapping Severity: Low
  • CAPEC-310 Scanning for Vulnerable Software Severity: Low
  • CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
  • CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
  • CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
  • CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
  • CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
  • CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
  • CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
  • CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
  • CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
  • CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
  • CAPEC-472 Browser Fingerprinting Severity: Low
  • CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
  • CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
  • CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
  • CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
  • CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
  • CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
  • CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
  • CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
  • CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
  • CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
  • CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2021-24122EPSS 23%

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some confi…

  2. 4.3CVE-2021-3031EPSS 0.5%

    Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount o…

  3. 7.7CVE-2020-4079EPSS 0.9%

    Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This all…

  4. 7.5CVE-2021-21469EPSS 1.2%

    When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adeq…

  5. 5.3CVE-2020-4336EPSS 1.0%

    IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: …

  6. 4.4CVE-2020-4913EPSS 0.3%

    IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288.

  7. 4.3CVE-2020-35934EPSS 1.1%

    The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object …

  8. 7.5CVE-2020-35611EPSS 1.3%

    An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

  9. 5.3CVE-2020-35710EPSS 1.7%

    Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" v…

  10. 5.3CVE-2020-25192EPSS 1.2%

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.

  11. 5.5CVE-2020-12518EPSS 0.7%

    On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.

  12. 5.3CVE-2020-4908EPSS 1.1%

    IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.

  13. 9.8CVE-2019-14480EPSS 1.1%

    AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.

  14. 6.5CVE-2020-0488EPSS 0.7%

    In ihevc_inter_pred_chroma_copy_ssse3 of ihevc_inter_pred_filters_ssse3_intr.c, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges …

  15. 5.3CVE-2019-19283EPSS 0.9%

    A vulnerability has been identified in XHQ (All Versions < 6.1). The application's web server could expose non-sensitive information about the server's architecture. This could allow an attacker to adapt further attacks to the version in p…

  16. 3.7CVE-2020-8284EPSS 3.9%

    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not…

  17. 7.5CVE-2020-8169EPSS 3.9%

    curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

  18. 9.8CVE-2020-25179EPSS 1.5%

    GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.

  19. 9.9CVE-2020-27134EPSS 1.7%

    Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access t…

  20. 5.3CVE-2020-26417EPSS 1.4%

    Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.

  21. 4.3CVE-2020-26415EPSS 0.8%

    Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

  22. 5.3CVE-2020-26413ExploitEPSS 35%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.

  23. 6.5CVE-2020-9849EPSS 2.1%

    An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0. A remote atta…

  24. 7.5CVE-2020-17527EPSS 25%

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the r…

  25. 7.5CVE-2020-5676EPSS 1.8%

    GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors.

  26. 7.5CVE-2020-29043EPSS 1.5%

    An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domai…

  27. 9.8CVE-2020-28333EPSS 3.2%

    Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a …

  28. 4.3CVE-2020-7568EPSS 0.5%

    A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic betw…

  29. 6.5CVE-2020-12496EPSS 0.8%

    Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The fi…

  30. 5.3CVE-2020-25703EPSS 1.5%

    The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.…

  31. 7.5CVE-2020-26076EPSS 1.3%

    A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive…

  32. 4.6CVE-2020-25746EPSS 0.3%

    QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility.

  33. 5.3CVE-2020-26230EPSS 1.7%

    Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possibl…

  34. 7.5CVE-2020-2022EPSS 1.2%

    An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context swi…

  35. 3.5CVE-2020-26220EPSS 0.8%

    toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is …

  36. 6.5CVE-2020-27403EPSS 2.7%

    A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive …

  37. 3.7CVE-2020-24406EPSS 2.1%

    When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attacker…

  38. 7.5CVE-2020-10291EPSS 1.4%

    Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from…

  39. 4.3CVE-2020-4649EPSS 0.8%

    IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.

  40. 3.5CVE-2019-4349EPSS 0.3%

    IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the confidentiality and integrity of the service. IBM X-Force ID: 161486

  41. 6.5CVE-2020-7196EPSS 0.9%

    The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, the…

  42. 4.3CVE-2020-27612EPSS 0.7%

    Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window.

  43. 7.5CVE-2020-15931EPSS 3.7%

    Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a si…

  44. 5.3CVE-2020-1777EPSS 0.8%

    Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS;…

  45. 4.3CVE-2020-15794EPSS 0.8%

    A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional informatio…

  46. 5.5CVE-2020-15250EPSS 1.7%

    In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because o…

  47. 7.5CVE-2020-26869EPSS 1.7%

    ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.

  48. 4.3CVE-2020-14183EPSS 1.3%

    Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers.…

  49. 7.5CVE-2020-1902EPSS 0.7%

    A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.

  50. 7.5CVE-2020-15235EPSS 1.0%

    In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) a…